CVE-2022-4470

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-447027.8Windows Terminal Remote Code Execution Vulnerability CVE-2022-447047.8Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability CVE-2022-447076.5Windows Kernel Denial of Service Vulnerability CVE-2022-447088.3Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability CVE-2022-44715.4The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page CVE-2022-447107.8DirectX Graphics Kernel Elevation of Privilege Vulnerability CVE-2022-447137.5Microsoft Outlook for Mac Spoofing Vulnerability CVE-2022-447158.8Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload CVE-2022-447173.1An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attack CVE-2022-447183.5An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attack CVE-2022-447197.5An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions.CVE-2022-44725.4The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back i